EUVD-2026-33883
GHSA-qmrp-jx57-5mr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain namespace edit credentials
-
DeliveryCraft Route YAML with malicious spec.path
-
ExploitSubmit Route via Kubernetes API
-
ExecutionRouter operator renders injected HAProxy config
-
PersistHAProxy reload applies attacker directives cluster-wide
-
ImpactHijack or disrupt other tenants' ingress traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Exploitation Conditions | Attacker must hold an authenticated identity on the OpenShift cluster with RBAC permission to create or update Route resources in at least one namespace (PR:L). The cluster must be using the default HAProxy-based OpenShift router that consumes Route spec.path into its rendered configuration. No user interaction is required (UI:N). Exploitation is limited by: (1) clusters where Route write permission is restricted to platform admins, (2) clusters running a non-HAProxy ingress (e.g., third-party ingress controller bypassing Route CRD), and (3) admission controllers that already constrain Route field syntax. AV:L indicates the cluster API endpoint is the relevant access surface, not raw internet reachability of the router. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is unusual: AV:L combined with a Route CRUD primitive suggests Red Hat is treating the Kubernetes API surface as 'local' relative to the cluster, requiring an authenticated tenant identity (PR:L) rather than network reachability - defenders should treat exposure as proportional to how many users hold Route create/edit rights in any namespace. Scope change to High CIA reflects the blast radius: the shared router process serves all tenants, so a single namespace user can affect cluster-wide ingress integrity. EPSS, KEV, and POC signals are not provided in the input - no public exploit identified at time of analysis and no CISA KEV listing. Real-world priority is high for multi-tenant clusters (managed OpenShift, internal PaaS) and lower for single-tenant clusters where every Route author is already trusted, but the scope-change cluster-wide impact still warrants prompt patching. |
| Exploit ScenarioDerived | A developer with edit rights in a single tenant namespace creates a Route whose spec.path contains crafted characters that terminate the intended HAProxy ACL line and inject additional directives (for example, redefining a backend, rewriting headers, or pointing traffic elsewhere). When the OpenShift router reloads, the malicious snippet becomes part of the shared HAProxy configuration and affects traffic for other tenants on the same router. No public PoC is referenced in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
RemediationAI
Patch available per vendor advisory - apply the Red Hat OpenShift Container Platform 4 errata for your z-stream as listed at https://access.redhat.com/security/cve/CVE-2026-1784 and tracked in https://bugzilla.redhat.com/show_bug.cgi?id=2436075 (exact fixed versions not enumerated in the supplied data, so cross-reference the RHSA aligned with your installed OCP minor). Until patched, restrict who can create or modify Route resources using RBAC - remove routes/create and routes/update from non-admin roles in shared namespaces, and consider an admission policy (OPA/Gatekeeper, Kyverno, or a ValidatingAdmissionPolicy) that rejects Route documents whose spec.path contains characters outside an allowlist such as [A-Za-z0-9/_.~-]; trade-off is that legitimate routes using exotic but valid path characters will be blocked and must be exempted. For multi-tenant clusters, audit existing Route objects across all namespaces for suspicious spec.path values before applying the fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenShift's Route resource is a Kubernetes CRD that exposes services through the cluster's shared HAProxy-based ingress router. The router operator translates spec.path and related stanzas from Route YAML documents into an HAProxy backend/frontend configuration that is reloaded into the running HAProxy process. The flaw is rooted in CWE-15 (External Control of System or Configuration Setting): input validation on spec.path was insufficient, so attacker-controlled content can escape the intended path-matching context and be interpreted as additional HAProxy configuration directives. Affected CPE strings cover Red Hat OpenShift Container Platform 4 (cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*).
Know when Red Hat Openshift Container Platform 4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Executive ViewAI
A configuration injection vulnerability in Red Hat OpenShift Container Platform 4's HAProxy ingress controller allows low-privileged tenants to manipulate cluster-wide routing configuration, breaking tenant isolation and potentially exposing traffic across all hosted applications. With no patch available, this uncontrolled access to critical cluster infrastructure represents a material risk to multi-tenant environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce least-privilege RBAC on Route resource creation-restrict to named service accounts with comprehensive audit logging; (2) Implement real-time monitoring and alerting for HAProxy ingress configuration changes; (3) Deploy network policies to limit blast radius of compromised tenant access; (4) Document manual procedures for rapid HAProxy configuration review if injection is suspected; contact Red Hat for official guidance on additional workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Affected Products (CPE)CVE.org
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape th
Exploit-DB